How to set up an alert email to trigger if a heavy forwarder goes down in our environment?

[brod_geico]

Hello,

i would like to setup an email alert if a heavy forwarder in our environment goes down. How do I do this?

[cpetterborg]

If you know a set of hosts that should be sending data through that forwarder you can do a search like this:

host=xyz123 OR host=abc456 OR host=l12345 OR host=qwerty

Then save the search, setting the action of the search to alert if there are zero events in the time period that you find pertinent to the search. This means that if you get no events from your set of hosts, then it is probably not sending (working) and therefore down. If you have a period that is too short that you are looking at, then you might have a network hiccup that would cause an alert, or that there just wasn't enough data going into Splunk, so you would get a alert then, too. If you have too long a period of time then the search will take a while to run and slow everything down. We have several of these going that will check in a 5 minute window for any events, and if there are none, then it alerts the parties that can look at the data feed.

If you need more details, just let me know by commenting.

[rphillips_splk]

by going down you mean stops sending monitored data to the indexers?